Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Félix Aime
Predators for Hire: A Global Overview of Commercial Surveillance Vendors
This blogpost is an abridged version of the report. The full version is available as a PDF. Introduction Key takeways Definitions 2010-2015. Emergence of early commercial spyware 2016-2021. Industrialisation of commercial surveillance vendors 2021-2024.
ViciousTrap - Infiltrate, Control, Lure: Turning edge devices into honeypots en masse.
This article on was originally distributed as a private report to our customers. Key Takeaways Sekoia.io investigated a threat actor nicknamed ViciousTrap, who compromised over 5,500 edge devices, turning them into honeypots. More than 50 brands — including SOHO routers, SSL VPNs, DVRs, and BMC controllers — are being monitored by this actor, possibly to collect exploited vulnerabilities affecting these systems.
From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tactic
Username or Email Address Password Remember Me This post was originally distributed as a private FLINT report to our customers on 21 March 2025. The report detailed findings about the Lazarus ClickFake Interview campaign. In March 2025, Bybit, an UAE-based crypto exchange platform, was targeted by Lazarus, a state-sponsored intrusion set attributed to the Democratic People’s Republic of Korea (DPRK), leading to the theft of $1.5 billion, which represents a record-breaking crypto heist in history.
PolarEdge: Unveiling an uncovered ORB network
This report on was originally published for our customers on 19 february 2025. The monitoring and analysis of vulnerability exploitations are among the primary responsibilities of Sekoia’s Threat Detection & Research (TDR) team. Using our honeypots, we monitor traffic targeting various edge devices and internet-facing applications. On 22 January 2025, suspicious network traces were observed via our honeypots. Analysis indicated an attempt to exploit the CVE-2023-20118 vulnerability.
Double-Tap Campaign: Russia-nexus APT possibly related to APT28 conducts cyber espionage on Central Asia and Kazakhstan diplomatic relations
This report was originally published for our customers on 12 December 2024. On Wednesday, 27 November 2024, Russian President Putin was on a 2-day state visit in Kazakhstan to discuss with local representatives the implementation of energy projects and to counter Chinese and Western influence.
SilentSelfie: Uncovering a major watering hole campaign against Kurdish websites
Key Takeaways In early 2024, Sekoia Threat Detection & Research team (TDR) was contacted about a suspicious script on a Kurdish website, which prompted users to activate their webcams and share their locations. Our investigation uncovered 25 kurdish websites compromised by four different variants of a malicious script, ranging from the simplest, which obtains the device’s location, to the most complex, which prompts selected users to install a malicious Android application.
A glimpse into the Quad7 operators' next moves and associated botnets
Username or Email Address Password Remember Me Key Takeaways The Sekoia TDR team has recently identified new staging servers, leading to the discovery of additional targets, implants, and botnet clusters tied to the Quad7 operators. The Quad7 botnet operators seem to be compromising several brands of SOHO routers and VPN appliances, including TP-LINK, Zyxel, Asus, Axentra, D-Link, and Netgear, using multiple vulnerabilities—some of which are previously unknown.
Solving the 7777 Botnet enigma: A cybersecurity quest
Key Takeaways Sekoia.io investigated the mysterious 7777 botnet (aka. Quad7 botnet), published by the independent researcher Gi7w0rm inside the “The curious case of the 7777 botnet” blogpost. This investigation allowed us to intercept network communications and malware deployed on a TP-Link router compromised by the Quad7 botnet in France.
Unplugging PlugX: Sinkholing the PlugX USB worm botnet
Key Takeaways In September 2023, we successfully sinkholed a command and control server linked to the PlugX worms. For just $7, we acquired the unique IP address tied to a variant of this worm, which had been previously documented by Sophos. Almost four years after its initial launch, between ~90,000 to ~100,000 unique public IP addresses are still infected, sending distinctive PlugX requests daily to our sinkhole. We observed in 6 months of sinkholing more than 2,5M unique IPs connecting to it.
The Predator spyware ecosystem is not dead
In September and October 2023, several open source publications, part of the Predator Files project coordinated by the European Investigative Collaborations, exposed the use of the Predator spyware by customers of Intellexa surveillance solutions. The intrusion set related to these customers is tracked under the code-name Lycantrox by Sekoia.
Active Lycantrox infrastructure illumination
On September 22, Citizenlab published a blog post regarding the use of Cytrox’s signature Predator spyware against the iPhone of the former Egyptian MP Ahmed Eltantawy.
Following NoName057(16) DDoSia Project’s Targets
Context DDoSia is a Distributed Denial of Service (DDoS) attack toolkit, developed and used by the pro Russia hacktivist nationalist group NoName057(16) against countries critical of the Russian invasion of Ukraine. The DDoSia project was launched on Telegram in early 2022. The NoName057(16) main group main Telegram channel reached more than 45,000 subscribers as of June 2023, while the DDoSia project channels reached over 10,000 users.
Iran Cyber Threat Overview
This blogpost aims at understanding and contextualising cyber malicious activities associated with Iran-nexus intrusions sets over the 2022-2023 period. It does not establish an exhaustive list of campaigns or reported intrusion sets, but rather offer a strategic analysis pertaining to the Iranian cyber threat. Information cut-off date is 5 May 2023. CONTEXT The Islamic Republic of Iran does not publicly communicate on their cyber offensive doctrine.
Bluenoroff’s RustBucket campaign
Like DPRK soldiers In April 2023, fellow security researchers at Jamf published a report on Bluenoroff’s RustBucket, a newly observed malware targeting macOS platform. Sekoia.io analysts further investigated Bluenoroff’s infrastructure and share their findings in this report. Bluenoroff is a North Korea-nexus intrusion set, allegedly subordinated to RGB’s Bureau 121 tasked with revenue generation since at least 2015.
APT28 leverages multiple phishing techniques to target Ukrainian civil society
Read it later Remove The APT28 intrusion set (aka. Sofacy, PawnStorm, Fancy Bear), associated to the Russian GRU and famous for its cyber espionage and sabotage campaigns, was observed using multiple phishing techniques to target the Ukrainian civil society. These techniques include using HTTP webhook services such as as Pipedream and Webhook, as well as compromised Ubiquity routers to steal victims’ credentials.
Rapport de l’ANSSI sur la cyberattaque ayant ciblé Centreon
L’ANSSI a publié un rapport faisant état d’une campagne de cyberattaques ayant ciblé plusieurs entreprises françaises, à priori depuis 2017, par le biais d’une porte dérobée installée dans le logiciel de Centreon.
IAmTheKing and the SlothfulMedia malware family
On October 1, 2020, the DHS CISA agency released information about a malware family called SlothfulMedia, which they attribute to a sophisticated threat actor. We have been tracking this set of activity through our private reporting service, and we would like to provide the community with additional context. In June 2018, we published the first report on a new cluster of activities that we named IAmTheKing, based on malware strings discovered in a malware sample from an unknown family.
Lazarus on the hunt for big game
We may only be six months in, but there’s little doubt that 2020 will go down in history as a rather unpleasant year. In the field of cybersecurity, the collective hurt mostly crystallized around the increasing prevalence of targeted ransomware attacks. By investigating a number of these incidents and through discussions with some of our trusted industry partners, we feel that we now have a good grasp on how the ransomware ecosystem is structured.
Holy water: ongoing targeted water-holing attack in Asia
On December 4, 2019, we discovered watering hole websites that were compromised to selectively trigger a drive-by download attack with fake Adobe Flash update warnings. This campaign has been active since at least May 2019, and targets an Asian religious and ethnic group.
FIN7.5: the infamous cybercrime rig “FIN7” continues its activities
On August 1, 2018, the US Department of Justice announced that it had arrested several individuals suspected of having ties to the FIN7 cybercrime rig. FIN7 operations are linked to numerous intrusion attempts having targeted hundreds of companies since at least as early as 2015. Interestingly, this threat actor created fake companies in order to hire remote pentesters, developers and interpreters to participate in their malicious business.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Félix
Contact Félix, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack